PG2.0 > Win2K : Restrict User > ...?

[PG Liker]

We have problem with setting PG2.0 at highest safety security settings with enabled { general proctections } + enabled { Execution Protection } - disable "Learning" after got enough which programs should be allowed to run. All question relate to limit/restrict users login session under multiple users OS like Win2k prof.
Problem 1 : if "un-recorded" prog tries to run => PG Exe protection window pops up but with all buttons are blacked and the system halted : needed a hard reset button press.
Problem 2 : How let users can use do their computer programming homework : everytime a new execute file (hw1.exe, hw2.exe) compiled and created : PG users need to go into PG setup to allow it to ask for execution previlegde. That means that users have to login as ADM and turn off "Block new/change program from execution" security feature and accept the reduced security safety when using a restrict account. I assume that [runas.exe] is blocked from running from a limit account on this box.
Thanks in advance for help.

[Pilli]

Hi PG Liker & welcome,

I have compiled several post by Jason for your perusal:

Process Guard can no longer be configured or used from a limited user account.
Protection is still active across all accounts however

Applications which are BLOCKED will just not run, applications which are allowed will work as normal.

Limited User accounts don't have certain access anyhow so they won't complain when they don't get it from Process Guard. Process Guard is for use by administrators, allowing limited users to change or view any settings is a vulnerability.

You can't run multiple versions of procguard.exe on the same system, and never will be. Simply shutdown procguard.exe in the other user account if you want to use it in another.

BTW there are certain "issues" with fast user switching that most likely will never be resolved. Any process run in any session other than 0 (the first account logged in) will be allowed to run by the execution protection unless it was specifally blocked always or "block all new and changed files from running" option is enabled.

Basically, you will not get a confirmation in any other account than the first one you logged into.